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Dense Subset Sum may be the hardest 

Per Austrin Petteri Kaski Mikko Koivisto Jesper Nederlof 


Abstract 

The Subset Sum problem asks whether a given set of n positive integers contains a subset of elements that sum 
up to a given target t. It is an outstanding open question whether the 0*(2"/^)-time algorithm for Subset Sum by 
Horowitz and Sahni [J. ACM 1974] can be beaten in the worst-case setting by a “truly faster”, 0*(2^°'®“^^")-time 
algorithm, with some constant 5 > 0. Continuing an earlier work [STACS 2015], we study Subset Sum parameterized 
by the maximum bin size P, dehned as the largest number of subsets of the n input integers that yield the same 
sum. For every e > 0 we give a truly faster algorithm for instances with /? < as well as instances with 

P > Consequently, we also obtain a characterization in terms of the popular density parameter n/logjt: if 

all instances of density at least 1.003 admit a truly faster algorithm, then so does every instance. This goes against 
the current intuition that instances of density 1 are the hardest, and therefore is a step toward answering the open 
question in the affirmative. Our results stem from novel combinations of earlier algorithms for Subset Sum and a 
study of an extremal question in additive combinatorics connected to the problem of Uniquely Decodable Code Pairs 
in information theory. 
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1 Introduction 

The Subset Sum problem and its generalization to the Knapsack problem are two of the most famous 
NP-complete problems. In the Subset Sum problem, we are given positive integers wi,W 2 , ■ ■ ■ jWnjt G Z 
as input, and need to decide whether there exists a subset X C [n] with ~ Knapsack 

problem, we are additionally given integers vi,V 2 , ■ ■ ■ ,Vn and are asked to find a subset X C [n] maximizing 
subject to the constraint While the study of Subset Sum is, among others, 

motivated by cryptographic applications or balancing problems. Knapsack has numerous applications in 
combinatorial optimization. We study the exact worst-case time complexity of these problems. The earliest 
and probably most important algorithms for both problems are simple applications of dynamic programming, 
pioneered by Bellman [3, solving both problems in 0*{t) time (where the 0*{-) notation suppresses factors 
polynomial in the input size). In terms of n, the best algorithms for both problems are due to Schroeppel 
and Shamir [15], using 0*(2"/^) time and space, based on the meet-in-the-middle technique by 

Horowitz and Sahni |9j. Nederlof et al. m show that there is an 0*(T")-time, 0*(5'")-space algorithm for 
Subset Sum if and only if there is an 0*(T")-time, 0*(S'”)-space algorithm for Knapsack. A major open 
question since the paper by Horowitz and Sahni |5] is whether we can do “truly faster” for both problems: 


Open Question 1: Can Subset Sum be solved in 0*(2(° ® time for some constant 5 > 0? 


Ill this paper we discuss Monte Carlo algorithms in the following sense: the algorithm never returns 
false positives and constructs solutions of yes-instances with at least inverse polynomial probability. All 
randomized algorithms discussed in this paper are of this type, but for Open Question [1] we would be 
satisfied with two-sided error as well. 

Zooming out, one motivation of this question is as follows. It is commonly believed that there are no 
polynomial time or even sub-exponential time algorithms for Subset Sum. So how fast can the fastest 
algorithm be? It would be an elegant situation if the simple meet-in-the-middle algorithm was optimal. But 
this would also be quite surprising, and so we aim to show that at least this is not the case. 

In 2010, Howgrave-Graham and Joux m gave an algorithm that answered Open Question 1 in the 
affirmative in an average case setting. To state their result, let us describe the setting where it applies. 
The density of a Subset Sum instance is defined as n/log 2 t. A random instance of density d > 0 is 
constructed by fixing t ~ 2"/'^ and picking the integers wi, , Wn , t independently and uniformly at random 
between 1 and 2"/'^. Howgrave-Graham and Joux [1^ showed that random instances of density 1 can be 
solved in 0*(2°-^^^") time, and later this has been improved to (9*(2°-^®^”’) time by Becker et al. These 
results resolve Open Question 1 in the average case setting since Impagliazzo and Naor m showed that 
random instances are the hardest when they have density 1. Indeed, a vast body of research has given better 
algorithms for random instances with density deviating from 1, like reductions of sparse instances to the 
shortest vector problem (e.g. [T4l|6|) and the algorithm by Flaxman and Przydatek |7|. 

The algorithms discussed thus far all use exponential space, which can be a serious bottleneck. Therefore 
many studies also emphasize the setting where the algorithm is restricted to using polynomial space. It 
is known that the running time of the dynamic programming based algorithms can be achieved also in 
polynomial space: Lokshtanov and Nederlof m give polynomial space algorithms solving Subset Sum in 
0*{t) time and Knapsack in pseudo-polynomial time. On the other hand, in terms of n, no polynomial 
space algorithm significantly faster than naively going through all 2"’ subsets is known, and the following 
has been stated as an open problem by a number of researchers (see e.g. m^y- 


Open Question 2: Can Subset Sum be solved in polynomial space and 0*(2*^^ time for 
some constant <5 > 0? 


1.1 Our results 

We aim to make progress on Open Question [1] and show that a large class of instances can be solved truly 
faster. An optimist may interpret this as an indication that truly faster algorithms indeed exist, while a 
pessimist may conclude the remaining instances must be the (strictly) hardest instances. 
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Algorithmic Results To define classes of instances that admit truly faster algorithms, we consider several 
natural parameters. The key parameter that seems to capture the range of our algorithmic technique the 
best is the maximum bin size /3(w) = max^^z |{<S' C [n] : main technical result is: 

Theorem 1.1. There exists a Monte Carlo algorithm that, for any 0 < e < 1/6, solves all instances of 
Subset Sum with p{w) < 2(0'5-e)" ^ time. 

We have not optimized the precise constants in Theorem ll.il - the main message is that any instance with 
bin size up to can be solved in time For e > 1/6, the running time of 2^^"/"^® obtained 

for e = 1/6 is still valid since remains an upper bound on /3{w). In a previous work [3], we solved 

Subset Sum in time which is faster than Theorem 1 1.1 1 for small /3(w), but Theorem ll.il 

shows that we can beat the meet-in-the-middle bound for a much wider class of instances. 

From the other end, we also prove that when the maximum bin size becomes too large, we can again 
solve Subset Sum truly faster: 

Theorem 1.2. There exist a constant i5 > 0 and a deterministic algorithm that solves all instances of 
Subset Sum with (3{w) > 2° ®®^" in time. 

Combinatorial Results Given Theorem ll.il a natural question is how instances with fi{w) > 2° ®" look like. 
This question is an instantiation of the inverse Littlewood-Offord problem, a subject well-studied in the field 
of additive combinatorics. Ideally we would like to hnd structural properties of instances with /3{w) > 2° ®”, 
that can be algorithmically exploited by other means than Theorem 1 1.1 1 in order to resolve Open Question [T] 
in the affirmative. While there is a large amount of literature on the inverse Littlewood-Offord problem, the 
typical range of /3{w) studied there is I3(w) = 2”/poly(n) which is not relevant for our purposes. However, 
we did manage to determine additional properties that any instance that is not solved by Theorem 11.11 must 
satisfy. 

In particular, we study a different natural parameter, the number of distinct sums generated by w, 
defined as |r(;(2["'l)| = {r(;(X) : X C [n]} (where we denote w{X) = This parameter can be 

viewed as a measure of the “true” density of an instance, in the following sense. An instance with density 
d = n/\og 2 t has |z(;(2["l)| < n2"'/^ (assuming without loss of generality that t < max^Wi). On the other 
hand, by standard hashing arguments (e.g.. Lemma [2.21 with B — 10|w(2["'l)|), any instance can be hashed 
down to an equivalent instance of density roughly n/log 2 |w(2["'l)|. 

The relationship between |w(2["'l)| and /3(rc) is more complicated. Intuitively, one would expect that if 
one has so much concentration that Piw) > 2° ®”, then w should not generate too many sums. We are 
not aware of any such results from the additive combinatorics literature. However, by establishing a new 
connection to Uniquely Decodable Code Pairs, a well-studied object in information theory, we can derive the 
following bound. 

Lemma 1.3. If |w(2["l)| > 20-997n < 20.4996n^ 

Unfortunately, we currently do not know how to algorithmically exploit |r(;(2["'l)| < But we do 

know how to exploit a set S with [S'! < n/2 and |u>(2‘®)| < 29'*9®9"' (see Lemma [3.21) . This suggests the 
question of how large f3{w) can be in instances lacking such an S, and we prove the following bound. 

Lemma 1.4. There is a universal constant 5 > 0 such that the following holds for all sufficiently large n. Let 
S,T be a partition of [n\ with jS”! = |r| = n/2 such that |t(;(2'®^)|, fy(2^)| > 2(1/^“'^)”. Then fl{w) < 

Further Consequences Combining Lemma [1.31 and Theorem o we see directly that instances that gen¬ 
erate almost 2" distinct sums can be solved faster than 29 ®". 

Theorem 1.5. There exists a Monte Carlo algorithm that solves all instances of Subset Sum with |iy(2["l)| > 

20.997n Q*(20.49991n)_ 

Combining this with the view described above of |i(;(2["l)| as a refined version of the density of an instance, 
we have the following result, to support the title of our paper: 
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Theorem 1.6. Suppose there exist a constant e > 0 and an algorithm that solves all Subset Sum instances 
of density at least 1.003 in time Then there exists a Monte Carlo algorithm that solves Subset 

Sum in time . 

After the result by Howgrave-Graham and Joux m, this may be a next step towards resolving Open 
Question [T] Intuitively, one should be able to exploit the fact that the integers in a dense instance have 
fewer than n bits. For example, even if only the target is picked uniformly at random, in expectation there 
will be an exponential number of solutions, which can easily be exploitedo 

Finally, let us note a somewhat curious consequence of our results. As mentioned earlier, in the context 
of Open Question!^ it is known that the running time for instances of density d achieved through 

dynamic programming can be achieved in polynomial space m (see also in Theorem 1(a)]). Combining 
this with Corollary 11.51 and hashing, we directly get the following “interleaving” of Open Questions [T] and [5] 

Corollary 1.7. There exist two Monte Carlo algorithms, one running in time and the other 

in (9*(20'999") time and polynomial space, such that every instance of SUBSET SUM is solved by at least one 
of the algorithms. 

Organization of the paper This paper is organized as follows: In Section [5] we review some preliminaries. 
In Section [3J we provide the proofs of our main algorithmic results. In Section]?] we prove two combinatorial 
lemmas. In Section[S]we give the proof for Theorem ll.6l Finally we end with some discussion on in Section[S] 

2 Preliminaries 

For a modulus m £ Z>i and x, y £ Z, we write x = y (mod m), or x =m y for short, to indicate that m 
divides x — y. Throughout this paper, wi,W 2 , ■ ■ ■ ,Wn,t will denote the input integers of a Subset Sum 
instance. We associate the set function w : 2^"! —Z with these integers by letting w{X) = ^rid 

for a set family T C 2["1 we write w(T') for the image {w(A) : X £ X}. 

For 0 < xi,X 2 , ■ ■ ■ ,Xi < 1 with J2i=i Xi = Iwe write h{xi,X 2 , ■ • ■, xf) = X]i=i fog 2 for the entropy 
function. Here, 01og2 0 should be interpreted as 0. We shorthand h{x, 1 — x) with h{x). We routinely use 
the standard fact (easily proved using Stirling’s formula) that for non-negative integers ni,..., nr (where i 
is a constant) summing to n, it holds that (^^ "■ ^^) = , poly)^). 

Claim 2.1. For every sufficiently large integer r the following holds. If p is a prime between r and 2r 
selected uniformly at random and x is a nonzero integer, then p divides x with probability at most (log 2 x)/r. 

Proof. By the Prime Number Theorem |H1 p. 494, Eq. (22.19.3)], there are at least r/log 2 r primes between 
r and 2r. A nonzero number x can have at most log,, x prime factors larger than r. The probability that a 
random prime between r and 2r is a factor of x is therefore at most (log,, x)/(r/ log 2 r) = (log 2 x)/ r. □ 

Lemma 2.2 (Bit-length reduction). There exists a randomized algorithm that takes as input a SUBSET SUM 
instance wi, W 2 , ■ • ■, Wn, t £ Z and an integer i? £ Z, and in time 0*(1) outputs a new SUBSET SUM instance 
w'l, W 2 , ■ • ■, w'^, £ Z such that with probability r2*(l), the following properties all simultaneously hold. 

1. 0 < w'i,W 2 ,... ,w!,.„t'< AnBlog 2 B. 

2. If B > 10 ■ |r(;(2["l)|, then X C [n] satisfies w{X) = t if and only if w'{X) = t'. 

3. If B> 10- |w(2W)|, then |u;(2W)|/2 < |u;'(2W)| < n|w(2N)|. 

4- If B >5 ■ |ri;(2["l)p, then j5{w)/n < P{w') < P{w). 

^ For example, assuming there are at least 2'^'^ solutions for a constant cr > 0, use a dynamic programming table data 
structure to randomly sample the subsets in the congruence class t mod q for q a random prime with about (1 — cr)ri./2 bits 
within linear time per sample. A solution is found within samples with high probability. 
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Proof. The algorithm picks a uniformly random prime p from the interval B log 2 1 < p < 2B log 2 1. It then 
outputs = Wi mod p for each i = 1 , 2 ,..., n and t' = it mod p) + r ■ p for a uniformly randomly chosen 
r G {0,..., n — 1}. The number of bits in p is 0*(1), so the reduction runs in 0*(1) time. 

This construction might not satisfy Property [T] if t is very large - instead it satisfies the weaker bound 
t' < 2 nB\og 2 t. The desired bound can be obtained by repeating the reduction 0(1) times - e.g., if after 
three steps t" is more than 2nB log 2 B, then the original number t was triply exponential and the input 
weights are so large that brute force time 0 *( 2 ") is 0 *( 1 ). 

Consider any two sums S w(2["l) U {t} with yi 1 / 2 - We have yi =p j /2 if and only if p divides 

X = y 2 — yi ^0. Since 0 < \y 2 — yi\ = \x\ < 2nt < (without loss of generality we assume t > 2n 
since otherwise dynamic programming lets us solve the instance in polynomial time), by Claim [2TT] we have 
yi =p j /2 with probability at most (log 2 |a;|)/(i?log 2 t) < 2 jB. 

To establish Property^ we take a union bound over the |z(;(2["l)| < B/10 different sums y G w( 2 [”l) \ {t} 
and deduce that with probability at least 4/5 over the choice of p, w(X) t implies w'{X) t'. In the 
other direction, if w(X) = t, then w'{X) = t' with probability exactly 1/n over the choice of r. 

For Property [3] the argument is similar: for any given sum y G w{2^'^^)^ the probability that there 
exists another sum y' y that collides with y mod p is at most 1/5. By Markov’s inequality, this implies 
that with probability at most 2/5, more than half of all y G r(;(2["l) collide with some other sum y' mod p. 
Conversely with probability at least 3/5, at least half of all y G w(2["l) have no such collision, and in this case 
|^'( 2 N)| > |t(;(2l"l)|/2. For the upper bound, two sets ^i, S 2 with w(Si) = 10 ( 82 ) have w'(Si) =p w'(S 2 ). 
Given w'(Si) modp, there are at most n possible different values for w'(Si), so each bin of w(2[®l) is split 
into at most n bins after the hashing. 

Finally, for PropertyUl we use a union bound over all pairs of sums in (“^ 2 * Since B > 5|r(;(2["l)p > 

10 (|i«( 2 i with probability at least 4/5, no two sums j/i, j /2 G w(2["l) are hashed to the same value mod p 
and thus I3(w') < (3(w). For the lower bound, we have as before that each original bin is split into at most 
n bins after hashing, and the largest of these must be at least a 1 /n fraction of the original bin size. 

Now we combine the above bounds to bound the probability all properties hold simultaneously: taking 
a union bound over the events depending on p, we have that with probability at least 1/5, w(X) t implies 
w'{X) t', and Properties [3] and |T] are satisfied. Conditioned on this, the final good event, that w(X) = t 
implies w'{X) = t still happens with probability 1/n since r is independent of p. □ 

3 Algorithmic Results 

This section establishes Theorems o and [T 2 l We begin with two lemmas showing how one can exploit a 
subset of the input integers if it generates either many or few distinct sums. The case of many sums is the 
main technical challenge and addressed by the following result, which is our main algorithmic contribution. 

Lemma 3.1. There is a randomized algorithm that, given positive integers wi,..., Wn, t < 2*^*-"^ and a set 
M G satisfying p < 0.5 and \w(2^)\ > 2'’'!^! for some 7 G [0,1], finds a subset X C [n] satisfying 
w(X) = t with probability n*(l) (if such an X exists) in time + /3(w)2(^-®“'>')^”). 

The proof is given in Section 13.11 Informally, it uses an algorithm that simultaneously applies the meet- 
in-the-middle technique of Horowitz and Sahni [3] on the set [n] \ M and the “representation technique” of 
Howgrave-Graham and Joux m on the set M. Specifically, we pick an arbitrary equi-sized partition L,R 
of [n] \ M and construct lists £ C 2 ^'^^ and TZ C Note that without restrictions on £ and TZ, one 

solution X is witnessed by 21^'^'’'^! pairs {S,T) from £ x 72. in the sense that S' U T = X. Now the crux is 
that since M generates many sums, M r\ X generates many sums (say 2'"’l*^l): this allows us to uniformly 
choose a congruence class of hp where p is a random prime of order and restrict attention only to 

sets S C LU M and T C RU M such that w(S) =p t^ and w(T) =p t — tL, while still finding solutions with 
good probability. This ensures that the to-be-constructed lists £ and TZ are small enough. As an indication 
for this, note that if |M fl A| = |M|/2 and \w({^\f^)\ H(2l'^l/^), the expected sizes of £ and TZ are at 

most 

In contrast to Lemma [3T1 it is straightforward to exploit a small subset that generates few sums: 
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Lemma 3.2. There is a deterministic algorithm that, given positive integers wi,..., Wn, t and a set M G (|^) 
satisfying fi < 0.5 and \w{2^)\ < for some 7 G [0,1], finds a subset X C [n] satisfying w{X) = t (if 

such an X exists) in time 0*(2 ^ 


Proof. Let L be an arbitrary subset of [n] \ M of size and let i? = [n] \ L. Then \w{2^)\ < = 

2 2 and 


\wi2^)\ < \wi2^)\■ |u;(2["l\-C'\^)| < 


= 2 2 


n 


Now apply routine dynamic programming to construct w{2^) in time 0*{\w{2^)\) and w{2^) in time 
0 *(|w(2'^)|); build a look-up table data structure for w{2^), and for each x G w{2^), check in 0 {n) time 
whether t — xG w{2^). □ 

Given these lemmas, we are now in the position to exploit small bins: 

Proof of Theorem \1.1\ We start by preprocessing the input with Lemma 12.21 taking B = 2^" >> |?ii(2["l)p. 
Let 7 = 1 — e/2,/i = 3e/2, and partition [n] into l//r parts Mi, ..., Mi/ ^ of size at most pin arbitrarily. 
We distinguish two cases. First, suppose that |ry(2^*)| > 2^^^" for some Mi (note that this can be easily 
determined within the claimed time bound). We then apply the algorithm of Lemma l3.II with M = Mi and 
solve the instance (with probability 12*(1)) in time 

q*^2(0'5+0-8113/j-7Ai)u. _|_ 

The coefficient of the exponent of the first term is 0.5-I-0.8113- 3e/2 — (1 — e/2) •3e/2 = 0.5 —0.28305e-|-0.75e^. 
The coefficient of the exponent of the second term is 0.5 — e -I- (1.5 — (1 — e/2)) • 3e/2 = 0.5 — e/4 -|- 0.75e^. 

Second, suppose that \w{2^^)\ < 2''''^” for all i. Let L = Uj=i Mi and i? = [n] \ M. We see that 


k(2^)|< n and k(2^)| < Y[ |u>(2^^)| < 23'"/2 , 


Using standard dynamic programming to construct w(2^) and w(2^) in 0*(|w(2'^)|) and C)*(|r(;(2'^)|) time, 
we can therefore solve the instance within 0*(23'”/^) = 0*(2(°-^“'^U)") time using linear search. □ 

Exploiting large bins is easy using Lemma 11.41 

Proof of Theorem \1.2i Pick an arbitrary equi-sized partition S, T of [n]. By the contrapositive of Lemma ll.41 
one of S and T generates at most 2!^/^“^)" sums. Applying Lemma [3.21 with the set in question as M, we 
get a running time of . □ 

The proof of Lemma 11.41 is given in Section 01 


3.1 Proof of Lemma 13.11 

We now prove Lemma [3.II Let s := |A fl M\. Without loss of generality, we may assume that s > |M|/2 
(by considering the actual target t and the complementary target t' := rc([n]) — t). We may further assume 
that s is known by trying all 0{n) possible values. The algorithm is listed in Algorithm [1] 

Running time We focus on the expected running time of Algorithm 0] (by returning no after running the 
algorithm at least twice its expected number of steps, this is sufficient). We will analyze the algorithm in 
two parts: (i) the generation of the lists C and TZ on Lines P and ITUl and (ii) the iteration over pairs in £ x 77. 
in Line01](the typical bottleneck). Let Wl := = 2 M-v)f 2 +hi^/ 2 )t,)n denote the size 

of the search space for £. 

Proposition 3.3. The lists C and 77 in Lmes 0 and \l(]\ can be constructed in expected time -\- 

Wl/ 2^^"), where the expectation is over the choice of p and t^. 
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Algorithm A{wi,..., Wn,t,M,s,^) Assumes |w(2'^)| > 

Output: yes, if there exists an A C [n] with te(A) = t and \X fl M\ = s 
1; Let a = s/\M\ 

2: Let TT = 7 — 1 + (T 

3: Pick a random prime p satisfying < P < 

4: Pick a random number 0 < < p — 1 

5: for all 0 < Si < S 2 < \M\ such that Si + S 2 = s do 

6: Let (Ti = Si/|M|,cr 2 = S 2 /|Ar| 

7: Let A = (1 — /i)/2 + {h{a/2) — h{(Ji)')p 

8: Let L,R be an arbitrary partition of [n] \ M such that \L\ = [An] 

9: Construct £ = {S' G 2^^^ : w{S) =p II and |S fl M| = si} 

10: Construct TZ = {T G : w{T) =pt — tL and |T fl M| = S 2 } 

11: for all {S,T) G C X TZ such that w{S) + w(T) = t do 

12: if S n r = 0 then return yes 

13: return no 

Algorithm 1: Exploiting a small subset generating many sums. 


1 /2 

Proof. By splitting the search space for C appropriately, we get two “halves” each of which has size Wj^ . 
Specifically, we arbitrarily pick a subset Li C L of size Ain with Ai = (A + h{a/2)p)/2 and generate using 
brute-force w{2^^) and w{C 2 ) where £2 = {Y U Z : Y C L \ Li and Z G Then we store w{2^^) in a 

dictionary data structure and, for each sum x G w{C 2 ), we look up all solutions with sum t — x mod p in the 
dictionary of w{2^^) and list for such a pair its union. This yields a running time of 0*(|£| -|- The 

expected size of |£| over the random choices of II is ]E[|£|] < 0{WlI2P^'^). 

The analysis for TZ is analogous and we get a running time of +Wr/2'^^'^^ where Wr := 2l^l ■ 

Let p = |i?|/n. Since h{-) is concave and, in particular, h{ai) -f h{a 2 ) < 2h(cr/2), we then have (up to a 
negligible term caused by rounding An to an integer) 

p=l-p-\={l- p)/2 - (/i(cr/ 2 ) - h{ai))p < (1 - p)/2 + {h{a/2) - h{a 2 ))p ■ 

Thus the case of R is symmetric to the situation for L and we have Wr < = 0*{Wl). □ 

The term ITl/ 2'^^" can be bounded by using the definition of 7 r = 7 —l-fcr and we get 

Since 1/2-1- h{a/2) — a subject to 1/2 < cr < 1 is maximized at cr = 1/2 where it is h(l/4) < 0.8113, we have 
that kTL/ 2 ^'"” < 2(0-5+0-8113/x-7/i)n_ 

The term is naively bounded by 2 ( 1 +^)"/^^ jg dominated by the term CI*(2(0'5+0-8 ii3/^-7A‘)") 

since /r < 1/2 and 7 < 1. It follows that Line [5] and Line [TUI indeed run within the claimed time bounds. 

Proposition 3.4. The expected number of pairs considered in Line [77] is 0 *(/ 3 (r(;) 2 ^i^'®“''')"^ ^ where the 
expectation is over the choice of p and tR. 

Proof. Dehne 

B={{P,Q) G 2 W X 2^ :wiP)+wiQ)=t}, 

and note that the set of pairs (S', T) G 2^^^ x 2^'^^ satisfying w{S) +w{T) = t are in one-to-one correspon¬ 
dence with pairs in B (by the map (S, T) 1 —>■ (S U (T fl i?), T fl M)). Furthermore, the size of B is bounded 
by \B\ < j3{w)2^^^-. for each of the 2^^^ possible choices of Q, there are at most fdiw) subsets R that sum to 
t - w{Q). 

Any given pair (S, T) G 2^^^ x 2^'-'^ satisfying w{L) + w{R) = tis considered only if w{S) =p t^, which 
happens with probability 0{2~^'^) (over the uniformly random choice of fy). Thus the expected number 
of pairs considered in Line [Tl] is upper bounded by 0 (|B|/ 2 ’^'^") = = 0{|3{w)2^^^^-^-Y^). 

Using a > 1/2, the desired bound follows. □ 





4 Combinatorial Results fLemmall.3land Lemma [L4ll 


7 


Correctness Suppose there exists an X C [n] with w{X) = t and \XC\M\ = s. Note that 2'''!^! < \w{2^)\ < 
. |i(;(2^\'’‘-)|, and since |tu(2^\^)| < we have that \w{2^^^)\ > 27 |M|-(i-cr)|M| _ 27r|M|_ 

Thus there must exist positive si + S 2 = s such that > 2'^I'^I/|M|. Let us focus on the 

corresponding iteration of Algorithm [TJ Let wl := w(A flL) be the contribution of L to the solution X. We 
claim that in this iteration, the following holds. 


Proposition 3.5. 


Pr 


3Qe 


(Mnx) 


w{Q) =p tL - Wl 



(3.1) 


Note that this is sufficient for establishing correctness of the algorithm, since conditioned on this event. 
Algorithm [T] will include S := Q U {L D X) in£ and T := X \ S in 72., and the algorithm recovers X. 


Proof. Let P C be a maximal injective subset, i.e., satisfying = |w(J^)| = fy | > 

^*(27r|M|)_ g. ^ |{y g jr 

: w(Y) =p i} I be the number of sets from T in the i’th bin mod p. Our goal 
is to lower bound the probability that Ctp-wp > 0 (where tr — wl is taken modulo p). We can bound the 
expected norm (e.g., the number of collisions) by 



^ Pr [p divides w{Y) - w{Z)\ < \P\ + 0*{\X \^, 
Y,zej^ 


(3.2) 


where the inequality uses Claim I^TT] and the assumption that the wfs are By Markov’s inequality, 

— 0*(|J^p/2’’'l'^l) with probability at least r2*(l) over the choice of p (here we used |.^| = 0*(2’’’l'^l) 
to conclude that the second term in (13.2|) dominates the first). Conditioned on this, Cauchy-Schwarz implies 
that the number of non-zero cfs is at least \X\'^ j > n*(2'"'l'^l). When this happens, the probability 

that ctp-WL > 0 (over the uniformly random choice of tL) is fl*(l). □ 

This concludes the proof of Lemma 13.11 


4 Combinatorial Results (Lemma 11.31 and Lemma ri.4|l 

In this section we provide two non-trivial quantitative relations between several structural parameters of the 
weights. Our results are by no means tight, but will be sufficient for proving our main results. 

For the purposes of this section, it is convenient to use vector notation for subset sums. In particular, 
for a vector x G Z”, we write x ■ w = ^iWi, and x~^{j) C [n] for the set of f G [n] such that Vi = j. 

Our approach to relate the number of sums |w(2["'l)| to the largest bin size /3(w) is to establish a connection 
to the notion of Uniquely Decodable Code Pairs from information theory, defined as follows. 

Definition 4.1 (Uniquely Decodable Code Pair, UDCP). If A,B C {0,1}" such that 

\A + B\ = \{a + b : a € A,b € B}\ = |A| • \B\ , 

then (A, B) is called uniquely decodable. Note that here addition is performed over Z" (and not mod Itf). 

UDCP’s capture the zero error region of the so-called binary adder channel, and there is a fair amount of 
work on how large the sets A and B can be (for a survey, see [191 §3-5.1]). The connection between UDCP’s 
and Subset Sum is that a Subset Sum instance that both generates many sums and has a large bin yields 
a large UDCP, as captured in the following proposition. 

Proposition 4.2. If there exist weights wi,... ,Wn such that |r(;(2["l)| = a and (iiw) = b, then there exists 
a UDCP (A,B) with |A| = a and \B\ = b. 

Proof. Let A C {0,1}" be an injective set, i.e., x ■ w ^ x' ■ w ioi all x,x' G A with x ^ x'. Note that there 
exists such an A with |A| = a. Let B C {0,1}" be a bin, i.e., y ■ w = y' ■ w ioi all y,y' G B. Note that we 
can take these to have sizes |A| = a and |i7| = b. 

We claim that {A, B) is a UDCP. To see this, let x,x' G A and y,y' G B with x + y = x' + y'. Then 
X ■ w + y ■ w = {x + y) ■ w = {x' + y') ■ w = x' ■ w -\- y' ■ w . 
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Thus X ■ w = x' ■ w, and so by the injectivity property of A, we have x = x', which in turn implies y = y' 
since x -\- y = x' + y'. □ 

We have the following result by Ordentlich and Shayevitz m Theorem 1, setting Ri = 0.997 and 
a = 0.07]. 

Theorem 4.3 ([TTj). Let A,B {0,1}" such that (A, B) is a UDCP and |A| > 2 ®®^". Then \B\ < 20-4996n_ 
With this connection in place, the proof of Lemma 11.31 is immediate. 

Lemma O (restated). //|t(;( 2 W)| > 20 - 997 n^ < 20-4996n_ 

Proof. Combine Theorem 14.31 with the contrapositive of Proposition 14.21 □ 

The remainder of this section is devoted to Lemma [1.41 

Lemma ll.4l (restated). There is a universal constant 5 > 0 such that the following holds for all sufficiently 
large n. Let S,T be a partition of [n] with IS”] = |T| = n/2 such that |u'(2‘®)|, |w(2^)| > 2^^^^“^^". Then 
I3{w) < 20 - 661 n^ 

The proof also (implictly) uses a connection to Uniquely Decodable Code Pairs, but here the involved 
sets of strings are not binary. There is no reason to believe that the constant 0.661 is tight. However, because 
a random instance w of density 2 satisfies the hypothesis for all partitions S,T and has fi{w) ~ 29-®" with 
good probability, just improving the constant 0.661 will not suffice for settling Open Question [T] 

4.1 Proof of Lemma 11.41 

For a subset S' C [n], define a function 6 s : Z —>■ Z by letting bs{x) be the number of subsets of S that sum 
to X. Note that |u>(2‘®)| equals the support size of bs, or || 6 s||o, and that Pw{S) = uiaxxbsix) = || 6 s||oo- 
Instead of working with these extremes, it is more convenient to work with the norm of bg, and the main 
technical claim to obtain Lemma [1.41 is the following. 

Proposition 4.4. There exists a6 > 0 such that for all sufficiently large |S| the following holds: if\w{2^)\ > 
2(i- 5)|S|^ t/ien || 6 s ||2 < 20'96i|‘S'l. 

Using Proposition 14.41 the desired bound of Lemma ll. 41 follows immediately, since 
/3([n]) = max V 6 s(y)&T(x - y) < max || 6 s|| 2 ||[>t ||2 < 2°-99^” , 

xGZ 

yez 


where the first inequality is by Cauchy-Schwarz and the second inequality by Proposition 14.41 

Proof of Proposition \4.4\ Without loss of generality we take S = [n], and to simplify notation we omit the 
subscript S from bg and simply write 6 : Z —^ Z for the function such that b{r) is the number of subsets of 
wi, ..., Wn summing to r. Note that 

\\b\\l= E KC/)=tc(U)]= E E [ya^ = 0 ]-2 l*'-^(o)l, 

c/,yc[n] U,V<Z[n] yG{-l,0,l}" 

unv=<l> 

where [p] denotes 1 if p holds and 0 otherwise. Defining B^ = {y G {—1, 0,1}" : y ■ w = 0 and ||y||i = crn}, 
we thus have 

n 

\\b\\l = E < nmax|H<,|2(i-)- . (4.1) 

i=0 

We now proceed to bound the size of B^ by an encoding argument. To this end, let A C {0,1}" be a 
maximal injective set of vectors. In other words, |A| = |i(;(2["l)| > 29-99”, pairs x ^ x' € A, it 

holds that x ■ w x' ■ w. We claim that |A + Ba\ = |A| • |i?cr|. To see this note that, similarly to the proof 
of Proposition mil ii x + y = x' + y' (with x,x' € A and y, y' G Ba) then x-w = x'-w (since y' ■ w = A) and 
thus X = x' and y = y' ■ 
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Define Pa to be all pairs {x, y) in Ax Ba that are balanced, in the sense that for some 7 > 0 the following 
conditions hold: 

\x-\l)ny-\-l)\ = ^\y-H-l)\±7n, 

|a:"^(l) n ?/"^(0)| = 5|?/"^(0)| ± 7 n , (4.2) 

|a;-^(l) n j/-^(l)| = ±7n. 

Claim 4.5. For 7 = i/S and n sufficiently large, we have that \Pa\ > |4l| • \Ba\/2. 


Proof. We prove the claim by giving an upper bound on the number of pairs that are not balanced. Note 
that if a pair {x,y) is not balanced, there must exist a j € {—1,0,1} such that (14.21) fails. Let us proceed 
with fixing a y € Ba and upper bounding the number of x G A such that 

|k"^(l) ny"^(j)| - ^\y~^{j)\ \ > in. (4.3) 

Recall the following basic property of the binary entropy function. 

Fact 4.6. For all a G [O, , it holds that /i(i — a) < 1 — 2a^/ In2. 

Using this bound, the number of x satisfying (10)1 is at most 


n max < n2(i-2T''/in2)n ^ 


and thus the number of pairs not balanced it at most 3n2(^ This is clearly at most a constant 

fraction of |A| • |i?£r| by the assumption 7 = y/S. □ 

Setting 7 = \f5, we can now proceed to upper bound |Pcr|. Consider the encoding rj : Pa ^ (“li 0,1, 2}" 
defined by r]{x,y) = x + y. By the property \A + Ba\ = |^| • \B\, it follows that rj is an injection, and thus 
|Pcr| equals the size of the image of rj. For a pair (x, y) G Pa, if y G Ba has ran many I’s, and (1 — r)crn 
many —I’s, then 2; = ry(x, y) has the following frequency distribution: 


n 


^±0,(1), 

L7 i + <U^±o,(i), 



n 

k-'(2)l 


n 


ra 1 — a 


2 2 
(l-r)cr 


± 0 ^( 1 ) , 


± 0.y(l) , 


where, for a variable e, we write 0^(1) to indicate a term that converges to 0 when e tends to 0. Since 7 = ^/S, 
we have 0^(1) = 05(1). The number of z’s with such a frequency distribution is bounded by 


(¥ + ^K( 


n 

2 




)n. 




20i( 


l)n 


(4.4) 


Then, \Pa\ is bounded by 

log \Pa\ < max (g{a,T) + o^{l))n, where g{a,T) = h(^,^ + 

Te[o,i] V 

It can be verified that g{a,T) is maximized for r = 1/2 and we have 

1 - f -1 - 14) = 1 + Hi) ■ 

Combining this with the bounds \Pa\ > \A\-\B\-2-^<^^^> and |R| > 2(1-'^)", we get that \Ba\ < 2(^( 
Plugging this into ()4.1I1 we see that 



cr/2)+os(l))n 


\\b\\l < inax2(i+'‘(‘"/2)-'^+°di))n . 

(7 


The expression h{a/2) — ct is maximized at ct = 2/5, and we obtain 

\\b\\l < 2('‘(1/5)+3/5+o,(1)) < 2(1-32195+oR1))" _ 

Thus if S is sufficiently small, we have ||6||| < 2^-^^^", as desired. □ 
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5 Proof of Theorem 11.61 

Proof of Theorem M .b\ Given oracle access to an algorithm that solves Subset Sum instance of density 
at least 1.003 in constant time, we solve an arbitrary instance 'Wi,W 2 , ■ ■ ■ ,Wmt of Subset Sum in time 
O* (20-49991’") as follows. 

As Step 1, run the algorithm of Theorem 11.51 for 0*(2O'4999in) timesteps. If it terminates within this 
number of steps, return YES if it found a solution and NO otherwise. Otherwise, as Step 2, run the 
preprocessing of Lemma [2.21 with B = 10 ■ 20-997n This yields a new instance with density 1/0.997 > 1.003, 
which we solve using the presumed oracle for such instances. If the oracle returns a solution, we verify that 
it is indeed a solution to our original instance and if so return YES. Otherwise we return NO. 

If there is no solution this algorithm clearly returns NO. If there is a solution and |r(;(2["'l)| > 29-997n^ 
hnd a solution with inversely polynomial probability in Step 1. If there is a solution and |r(;(2[’"l)| < 29-997n^ 
Property [5] of Lemma 12.21 guarantees that the solution to the reduced instance is a solution to the original 
instance with probability f2*(l), and the oracle will then provide us with the solution. □ 

6 Further Discussion 

Our original ambition was to resolve Open Question [1] affirmatively by a combination of two algorithms that 
exploit small and large concentration of the sums, respectively. Since we only made some partial progress 
on this, it remains an intruiging question whether this approach can fulfill this ambition. In this section we 
speculate about some further directions to explore. 

Exploiting Large Density Eor exploiting a density 1.003 < d < 2, the meet-in-the-middle technique [9] does 
not seem directly extendable. A different, potentially more applicable 0*(2’"/^) algorithm works as follows: 
pick a prime p of order 2""/^, build the dynamic programming table that counts the number of subsets with 
sum congruence to t mod p, and use this as a data structure to uniformly sample solutions mod p with linear 
delay; try 0*(2"'/9) samples and declare a no-instance if no true solution is found (see also Eootnote[T]). As 
such, this does not exploit large density at all, but to this end one could seek a similar sampler that is more 
biased to smaller bins. 

Sharper Analysis of Algorithm [1] The analysis of Algorithm [1] in Lemma ITTl and in particular the typical 
bottleneck j3(w)2^^-^~~*'>^'^ in the running time, is quite naive. Eor example, since we can pick M as we 
like (and assume it generates many sums), for the algorithm to fail we need an instance where big bins 
are encountered by the algorithm for many choices of M. It might be a good approach to first try to 
extend the set of instances that can be solved ‘truly faster’ in this way, e.g. to the set of all instances with 
l3{w) < for some small (5 > 0. 

As an illustration of the looseness, let us mention that in a previous version of this manuscript, we used 
a more sophisticated analysis to show the following: there exists some 5 > 0, such that if |r(;(2[”l)| > 
then ^ 

\{{P, Q) G : w{P) + w{Q) = t}\ < 20-5254". 

We used this to show that all instances with |i(;(2["l)| > 2(4“^)" can be solved via a mild variant of Algorithm[T] 
with M = [n], indicating that Algorithm [T] gives non-trivial algorithms even for large M. 

Sharper Combinatorial Bounds Lemma [T751 and Lemma fOl seem to be rather crude estimates. In fact, we 
don’t even know the following (again, borrowing notation from the proof of Proposition 14.411 : 


Open Question 3: Suppose |r(;(2[’"l)| > 2^^ Can f3{w) and || 6 [n ]||2 be bounded by 2°dP'^ and 
2 ( 9 - 5 +°di))", respectively? 
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Note that the second bound would follow from the first bound. Furthermore, if the second bound holds, 
we would be able to solve, for all e > 0, all instances with |,8(w)| > in time )") for some 

e' > 0 depending on e, via the proof of Theorem 11.21 

In recent work [2] we proved the following modest progress 

Lemma 6.1. There exists <5 > 0 such that if A, B C {0,1}" is a UDCP and |^| > then \B\ < 

20.4115n 


Plugging this into the proof of Lemma [T751 this gives that P{w) < in the setting of Open 

Question[3] We would like to remark that improving this beyond via Lemma [TT51 is not possible 

since UDCP pairs {A, B) with |A| > and \B\ > 2"/^ do exist [H]. 

One may also wonder whether we can deal with instances with |w(2["l)| > for all e > 0 by 

arguing 13 (w) must be small but this does not work directly: there are instances with |w(2[”l)| = 3"/^ and 
I3{w) = 2"/^ (the instance 1,1, 3, 3,9, 9, 27, 27,... has this, though is it easily attacked via Lemma [3. 21) . 
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